TEL AVIV, September 28 — The shift is already underway: Check Point Software Technologies has confirmed active exploitation of two critical pre-authentication vulnerabilities in its Security Gateway product, marking a rapid escalation in threats targeting enterprise network defenses. On September 12, 2026, the company disclosed that threat actors began leveraging CVE-2026-85102, a remote code execution flaw in VPN certificate handling, and CVE-2026-93616, a path traversal vulnerability in the Management web service enabling script execution and Java class loading.
Check Point confirmed that CVE-2026-93616 had been exploited as a zero-day since July 23, 2026, based on internal telemetry and external alerts. The Dutch Nationaal Cyber Security Centrum (NCSC) issued an urgent warning on September 10, 2026, noting imminent exploitation and urging immediate patching.
By September 12, exploitation attempts were observed originating from anonymization infrastructure such as VPN services and proxies, with attackers using certificates bearing specific subjects — though Check Point stressed these subjects reflect only current observations and more variants may be in use. U.S. Cybersecurity and Infrastructure Security Agency (CISA) swiftly added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply fixes or mitigations by September 25, 2026.
Check Point outlined detailed remediation steps: for CVE-2026-85102, administrators should install LivePatch Take 26 on R81.20, R82, or R82.10 gateways, or apply specific Jumbo Hotfixes including R81.20 Take 166, R82 Take 126, R82.10 Take 44, or R81.10 Take 190, or later. Spark firewalls require updates to R82.00.10 Build 2325 or R81.10.17 Build 4968, or newer.
Administrators can verify LivePatch status using the cpinfo -y CPupdates command in expert mode. Those who deployed earlier offline LivePatch packages must apply Take 26 for full protection. Where patching isn’t feasible, Check Point advises disabling VPN implied rules and creating explicit rules to limit Site-to-Site VPN on UDP/500 and UDP/4500 to known peer IPs.
For Remote Access VPN, only essential services should be permitted over UDP/500, UDP/4500, TCP/443, and TCP/80, with source IP ranges restricted where possible — noting these mitigations do not apply to locally managed Spark firewalls. For CVE-2026-93616, Check Point directs users to a dedicated support article containing mitigation and threat hunting guidance. The company reiterated that observed certificate subjects are derived from current telemetry and may not encompass all active variants.
Watch this space: as attackers refine their use of anonymization chains and certificate-based evasion, the trend underneath is clear — zero-day exploits in trusted security infrastructure are no longer rare events but accelerating pressures demanding faster patch cycles and deeper telemetry integration. What’s changing is not just the threat landscape, but the speed at which defenders must respond.
